What is a lessons-learned review after an incident?
It is a meeting, held within a few weeks of the incident, in which everyone involved goes through what happened and what to change. Use the incident log to rebuild the timeline, then ask four questions: what went well, what went badly, what did we not know or not have, and what will we change, with an owner and a date for each change. Keep it blameless: the aim is to fix systems and procedures, not to find someone to punish, otherwise people hide mistakes the next time. Typical outcomes are a closed remote-access path, MFA where it was missing, a backup that is now offline, a phone list that works, a log that is kept longer. Feed the results into your plan and your next tabletop exercise. NetSenX alerts and the audit log give the review a factual timeline for the network side.
Read next
Related questions
- What do we do with a security alert at night when nobody is on call?
- Could we have seen a weekend ransomware attack coming?
- How much time passes between first access and encryption?
- How can ransomware spread through a USB stick or external drive?
- What evidence should we keep for the insurer, the police and the regulator?